More lyke OopsSEC, am Ich righte?
March 27, 2025 at 3:17 AM
More lyke OopsSEC, am Ich righte?
Oopssec?
(I'm sure I'm not the first on that one)
(I'm sure I'm not the first on that one)
March 25, 2025 at 3:31 AM
Oopssec?
(I'm sure I'm not the first on that one)
(I'm sure I'm not the first on that one)
The consequences of OopsSec are lateral moves, apparently
The Senate confirmed Mike Waltz to be the next U.S. ambassador to the United Nations after months of delays. Waltz was ousted as President Trump’s national security adviser in May after he mistakenly added a journalist to a private Signal chat used to discuss sensitive military plans.
Mike Waltz pledges to make UN 'great again' at Senate confirmation hearing
Mike Waltz says that as U.S. ambassador to the United Nations the U.S. is reviewing its support and opting to go “back to basics.”
bit.ly
September 19, 2025 at 7:25 PM
The consequences of OopsSec are lateral moves, apparently
Precisely! No level of encryption is good enough to overcome OopsSec
April 21, 2025 at 2:41 AM
Precisely! No level of encryption is good enough to overcome OopsSec
Tired: OpSec
Wired: OopsSec
Wired: OopsSec
March 24, 2025 at 10:07 PM
Tired: OpSec
Wired: OopsSec
Wired: OopsSec
Path Traversal: Escaping the Documents Directory via the Files API
https://koadt.github.io/oss-oopssec-store/posts/path-traversal-documents-api
https://koadt.github.io/oss-oopssec-store/posts/path-traversal-documents-api
Path Traversal: Escaping the Documents Directory via the Files API | OopsSec Store - Walkthroughs
Exploiting an unsanitized file path parameter in OopsSec Store's documents API to read files outside the intended directory and retrieve a flag.
koadt.github.io
October 6, 2026 at 3:42 PM
Path Traversal: Escaping the Documents Directory via the Files API
https://koadt.github.io/oss-oopssec-store/posts/path-traversal-documents-api
https://koadt.github.io/oss-oopssec-store/posts/path-traversal-documents-api
Buying Everything for $0.01 by Editing a POST Request
https://koadt.github.io/oss-oopssec-store/posts/client-side-price-manipulation/
https://koadt.github.io/oss-oopssec-store/posts/client-side-price-manipulation/
Client-Side Price Manipulation | OopsSec Store - Walkthroughs
Exploiting a server-side validation failure in OopsSec Store's checkout process to purchase products at arbitrary prices.
koadt.github.io
October 5, 2026 at 3:42 PM
Buying Everything for $0.01 by Editing a POST Request
https://koadt.github.io/oss-oopssec-store/posts/client-side-price-manipulation/
https://koadt.github.io/oss-oopssec-store/posts/client-side-price-manipulation/
Becoming Admin by Adding One Field to the Signup Request
https://koadt.github.io/oss-oopssec-store/posts/mass-assignment-admin-privilege-escalation/
https://koadt.github.io/oss-oopssec-store/posts/mass-assignment-admin-privilege-escalation/
Mass Assignment: Admin Privilege Escalation via Signup | OopsSec Store - Walkthroughs
Exploiting a mass assignment vulnerability in OopsSec Store's signup endpoint to create an account with administrator privileges.
koadt.github.io
October 7, 2026 at 3:42 PM
Becoming Admin by Adding One Field to the Signup Request
https://koadt.github.io/oss-oopssec-store/posts/mass-assignment-admin-privilege-escalation/
https://koadt.github.io/oss-oopssec-store/posts/mass-assignment-admin-privilege-escalation/
React2Shell: Remote Code Execution Through React Server Components
https://koadt.github.io/oss-oopssec-store/posts/react2shell-cve-2025-55182/
https://koadt.github.io/oss-oopssec-store/posts/react2shell-cve-2025-55182/
React2Shell: Exploiting CVE-2025-55182 in React Server Components | OopsSec Store - Walkthroughs
A technical analysis of CVE-2025-55182, demonstrating how React Server Components deserialization leads to remote code execution.
koadt.github.io
October 8, 2026 at 3:42 PM
React2Shell: Remote Code Execution Through React Server Components
https://koadt.github.io/oss-oopssec-store/posts/react2shell-cve-2025-55182/
https://koadt.github.io/oss-oopssec-store/posts/react2shell-cve-2025-55182/
Reading Secrets From the Browser: The NEXT_PUBLIC_ Trap in Next.js
https://koadt.github.io/oss-oopssec-store/posts/next-public-env-variable-leak/
https://koadt.github.io/oss-oopssec-store/posts/next-public-env-variable-leak/
Reading Secrets From the Browser: The NEXT_PUBLIC_ Trap in Next.js | OopsSec Store - Walkthroughs
Exploiting a misused NEXT_PUBLIC_ environment variable in OopsSec Store to recover a payment secret embedded in the client JavaScript bundle.
koadt.github.io
October 2, 2026 at 3:42 PM
Reading Secrets From the Browser: The NEXT_PUBLIC_ Trap in Next.js
https://koadt.github.io/oss-oopssec-store/posts/next-public-env-variable-leak/
https://koadt.github.io/oss-oopssec-store/posts/next-public-env-variable-leak/
BREAKING: President Trump's national security adviser Mike Waltz and his deputy are leaving their posts, sources say.
Trump's national security adviser Mike Waltz and his deputy to leave posts in White House
President Trump's national security adviser Mike Waltz and deputy Alex Wong are leaving the White House, multiple sources tell CBS News.
cbsn.ws
May 1, 2025 at 2:58 PM
SSRF: Making the Server Fetch Its Own Internal Pages
https://koadt.github.io/oss-oopssec-store/posts/ssrf-internal-page-access/
https://koadt.github.io/oss-oopssec-store/posts/ssrf-internal-page-access/
Server-Side Request Forgery: Accessing Internal Pages via Support Form | OopsSec Store - Walkthroughs
Exploiting a server-side request forgery vulnerability in OopsSec Store's support form to access restricted internal pages.
koadt.github.io
October 4, 2026 at 3:42 PM
SSRF: Making the Server Fetch Its Own Internal Pages
https://koadt.github.io/oss-oopssec-store/posts/ssrf-internal-page-access/
https://koadt.github.io/oss-oopssec-store/posts/ssrf-internal-page-access/
IDOR: Browsing Other People's Orders by Changing the URL
https://koadt.github.io/oss-oopssec-store/posts/idor-order-privacy-breach/
https://koadt.github.io/oss-oopssec-store/posts/idor-order-privacy-breach/
Insecure Direct Object Reference: Unauthorized Order Access | OopsSec Store - Walkthroughs
How changing one number in the URL lets you read anyone's order on OopsSec Store.
koadt.github.io
October 3, 2026 at 3:42 PM
IDOR: Browsing Other People's Orders by Changing the URL
https://koadt.github.io/oss-oopssec-store/posts/idor-order-privacy-breach/
https://koadt.github.io/oss-oopssec-store/posts/idor-order-privacy-breach/
I had never heard oopssec before. 😆I'm going to have to steal that one.
April 21, 2025 at 2:45 AM
I had never heard oopssec before. 😆I'm going to have to steal that one.
I’m not calling it Signalgate.
It’s OopsSec.
It’s OopsSec.
March 29, 2025 at 3:34 AM
I’m not calling it Signalgate.
It’s OopsSec.
It’s OopsSec.
March 28, 2025 at 4:29 AM
I’m not calling it Signalgate.
It’s OopsSec.
It’s OopsSec.
SQLi to Admin Login: The MD5 + Rainbow Table Combo
https://koadt.github.io/oss-oopssec-store/posts/weak-md5-hashing-admin-compromise/
https://koadt.github.io/oss-oopssec-store/posts/weak-md5-hashing-admin-compromise/
Chaining SQL Injection and Weak MD5 Hashing to Compromise the Admin Account | OopsSec Store - Walkthroughs
Exploiting a database leak combined with weak MD5 password hashing to gain admin access.
koadt.github.io
October 1, 2026 at 3:42 PM
SQLi to Admin Login: The MD5 + Rainbow Table Combo
https://koadt.github.io/oss-oopssec-store/posts/weak-md5-hashing-admin-compromise/
https://koadt.github.io/oss-oopssec-store/posts/weak-md5-hashing-admin-compromise/
The JWT Signing Secret Was Literally "secret"
https://koadt.github.io/oss-oopssec-store/posts/jwt-weak-secret-admin-bypass/
https://koadt.github.io/oss-oopssec-store/posts/jwt-weak-secret-admin-bypass/
JWT Weak Secret: Cracking the Key to Forge Admin Access in OopsSec Store | OopsSec Store - Walkthroughs
Exploiting a JWT implementation that uses a weak signing secret to crack the key, forge admin credentials, and access restricted endpoints.
koadt.github.io
September 30, 2026 at 3:42 PM
The JWT Signing Secret Was Literally "secret"
https://koadt.github.io/oss-oopssec-store/posts/jwt-weak-secret-admin-bypass/
https://koadt.github.io/oss-oopssec-store/posts/jwt-weak-secret-admin-bypass/
Stored XSS: When React Stops Protecting You
https://koadt.github.io/oss-oopssec-store/posts/stored-xss-product-reviews/
https://koadt.github.io/oss-oopssec-store/posts/stored-xss-product-reviews/
Stored XSS in Product Reviews | OopsSec Store - Walkthroughs
Exploiting stored cross-site scripting in OopsSec Store's product review functionality to execute JavaScript in every visitor's browser.
koadt.github.io
September 28, 2026 at 3:42 PM
Stored XSS: When React Stops Protecting You
https://koadt.github.io/oss-oopssec-store/posts/stored-xss-product-reviews/
https://koadt.github.io/oss-oopssec-store/posts/stored-xss-product-reviews/
Broken Function Level Authorization: Hijacking the Live Stream
https://koadt.github.io/oss-oopssec-store/posts/live-stream-hijack/
https://koadt.github.io/oss-oopssec-store/posts/live-stream-hijack/
Broken Function Level Authorization: Hijacking the Live Stream | OopsSec Store - Walkthroughs
OopsSec Live hides the broadcast controls from non-admins in the UI, but the API never checks your role. Any logged-in customer can replace the live stream, exactly like the 2026 FIFA internal-systems hack.
koadt.github.io
September 29, 2026 at 3:42 PM
Broken Function Level Authorization: Hijacking the Live Stream
https://koadt.github.io/oss-oopssec-store/posts/live-stream-hijack/
https://koadt.github.io/oss-oopssec-store/posts/live-stream-hijack/
MCP Malicious Server - Poisoned Tool Response
https://koadt.github.io/oss-oopssec-store/posts/mcp-malicious-server/
https://koadt.github.io/oss-oopssec-store/posts/mcp-malicious-server/
Malicious MCP Server: Poisoning an AI Agent Through Tool Responses | OopsSec Store - Walkthroughs
We host a malicious MCP server whose tool responses trick OSSBot into calling a restricted internal tool and leaking the flag.
koadt.github.io
September 8, 2026 at 3:42 PM
MCP Malicious Server - Poisoned Tool Response
https://koadt.github.io/oss-oopssec-store/posts/mcp-malicious-server/
https://koadt.github.io/oss-oopssec-store/posts/mcp-malicious-server/